Use tags to create policies

Resource Manager tags help control access to your Google Cloud resources. Resource Manager tags let you organize your Google Cloud resources and conditionally allow or deny policies based on whether a resource has a specific tag. You can use Resource Manager tags to tag each virtual machine (VM) instance by segment and service type. Resource Manager tags let you uniquely identify hosts when creating Secure Web Proxy policies.

This guide shows you how to do the following:

• Create a Secure Web Proxy instance with an empty policy.
• Create and apply Resource Manager tags to VM instances.
• Use Resource Manager tags to create a Secure Web Proxy policy.
• Create a Secure Web Proxy instance.
• Test connectivity from your VMs.

Before you begin

• Complete the initial setup steps.

• Have an organization administrator grant you the necessary role to create and update tags.

• Verify that you have the Google Cloud CLI version 406.0.0 or later installed:

  gcloud version | head -n1
  

  If you have an earlier gcloud CLI version installed, update the version:

  gcloud components update --version=406.0.0
  

Create a Secure Web Proxy instance with an empty policy

To create a Secure Web Proxy instance, first create an empty security policy and then create a web proxy.

Create an empty security policy

Console

1. In the Google Cloud console, go to the Network Security page.

   Go to Network Security

2. Click Secure Web Proxy.

3. Click the Policies tab.

4. Click Create a policy.

5. Enter a name for the policy that you want to create, such as myswppolicy.

6. Enter a description of the policy, such as My new swp policy.

7. In the Regions list, select the region where you want to create the policy.

8. Click Create.

Cloud Shell

1. Use your preferred text editor to create the file POLICY_FILE.yaml. Replace POLICY_FILE with the filename that you want for the policy file.

2. Add the following to the YAML file that you created:

   name: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
   description: POLICY_DESCRIPTION
   

   Replace the following:

   • PROJECT_NAME: the name of your project
   • REGION: the region that this policy applies to
   • POLICY_NAME: the name of the policy that you're creating
   • POLICY_DESCRIPTION: the description of the policy that you're creating

3. Import the security policy:

   gcloud network-security gateway-security-policies import POLICY_NAME \
       --source=POLICY_FILE.yaml \
       --location=REGION
   

Create a web proxy

Console

1. In the Google Cloud console, go to the Network Security page.

   Go to Network Security

2. Click Secure Web Proxy.

3. Click Set up a web proxy.

4. Enter a name for the web proxy that you want to create, such as myswp.

5. Enter a description of the web proxy, such as My new swp.

6. In the Regions list, select the region where you want to create the web proxy.

7. In the Network list, select the network where you want to create the web proxy.

8. In the Subnetwork list, select the subnetwork where you want to create the web proxy.

9. Enter the web proxy IP address.

10. In the Certificate list, select the certificate that you want to use to create the web proxy.

11. In the Policy list, select the policy that you created to associate the web proxy with.

12. Click Create.

Cloud Shell

1. Use your preferred text editor to create the file GATEWAY_FILE.yaml. Replace GATEWAY_FILE with the filename that you want for the web proxy file.

2. Add the following to the YAML file that you created:

   name: projects/PROJECT_NAME/locations/REGION/gateways/GATEWAY_NAME
   type: SECURE_WEB_GATEWAY
   ports: [GATEWAY_PORT_NUMBERS]
   certificateUrls: [CERTIFICATE_URLS]
   gatewaySecurityPolicy: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
   network: projects/PROJECT_NAME/global/networks/NETWORK_NAME
   subnetwork: projects/PROJECT_NAME/regions/REGION/subnetworks/SUBNET_NAME
   addresses: [GATEWAY_IP_ADDRESS]
   scope: samplescope
   

   Replace the following:

   • GATEWAY_NAME: the name for this instance
   • GATEWAY_PORT_NUMBERS: a list of port numbers for this gateway, such as [80,443]
   • CERTIFICATE_URLS: a list of SSL certificate URLs

   • SUBNET_NAME: the name of the subnet that contains GATEWAY_IP_ADDRESS

     Important: This subnet is not the proxy-only subnet that you created previously. It should be a subnet of type PRIVATE.

   • GATEWAY_IP_ADDRESS: an optional list of IP addresses for your Secure Web Proxy instances within the proxy subnets previously created in the initial setup steps

     If you choose not to list IP addresses, omit the field to have the web proxy choose an IP address for you.

3. Create a Secure Web Proxy instance:

   gcloud network-services gateways import GATEWAY_NAME \
       --source=GATEWAY_FILE.yaml \
       --location=REGION
   

Test connectivity

To test connectivity, use the curl command from any VM within your Virtual Private Cloud (VPC) network:

  curl -x https://GATEWAY_IP_ADDRESS:PORT_NUMBER https://www.example.com --proxy-insecure

A 403 Forbidden error is expected.

Create and attach Resource Manager tags

Do the following to create and attach Resource Manager tags:

1. Create the tag keys and values.

   When you create your tag, designate it with a GCE_FIREWALL purpose. Google Cloud networking features, including Secure Web Proxy, require the GCE_FIREWALL purpose to apply the tag. However, you can use the tag for other actions.

2. Bind tags to VM instances.

Create Secure Web Proxy rules

To create Secure Web Proxy rules, do the following:

1. Use your preferred text editor to create a RULE_FILE.yaml file. Replace RULE_FILE with your desired filename.

2. To allow access to a URL from the desired tag, add the following to the YAML file:

   name: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME/rules/RULE_NAME
   description: RULE_DESCRIPTION
   enabled: true
   priority: RULE_PRIORITY
   sessionMatcher: CEL_EXPRESSION
   basicProfile: ALLOW
   

   Replace the following:

   • RULE_NAME: a name for this rule
   • RULE_DESCRIPTION: a description for the rule that you're creating
   • RULE_PRIORITY: the priority for this rule; a lower number corresponds to a higher priority

   • CEL_EXPRESSION: a Common Expression Language (CEL) expression

     For more information, see CEL matcher language reference.

   For example, to allow access to example.com from the desired tag, add the following to the YAML file that you created for the sessionMatcher:

   sessionMatcher: "source.matchTag('TAG_VALUE') && host() == 'example.com'"
   

   Replace TAG_VALUE with the tag that you want to allow, of the form tagValues/1234.

3. Import the rules that you created:

   gcloud network-security gateway-security-policies rules import RULE_NAME \
      --source=RULE_FILE.yaml \
      --location=REGION \
      --gateway-security-policy=POLICY_NAME
   

Test connectivity

To test connectivity, use the curl command from any VM associated with the TAG_VALUE tag:

curl -x https://IPv4_ADDRESS:443 http://example.com 
--proxy-insecure

Replace IPv4_ADDRESS with the IPv4 address of your Secure Web Proxy instance.

What's next

• Use a URL list to create policies
• Assign static IP addresses for egress traffic